/*
 * Copyright (c) 1995-1998 by Cisco systems, Inc.
 *
 * Permission to use, copy, modify, and distribute this software for
 * any purpose and without fee is hereby granted, provided that this
 * copyright and permission notice appear on all copies of the
 * software and supporting documentation, the name of Cisco Systems,
 * Inc. not be used in advertising or publicity pertaining to
 * distribution of the program without specific prior permission, and
 * notice be given in supporting documentation that modification,
 * copying and distribution is by permission of Cisco Systems, Inc.
 *
 * Cisco Systems, Inc. makes no representations about the suitability
 * of this software for any purpose.  THIS SOFTWARE IS PROVIDED ``AS
 * IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
 * WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
 * FITNESS FOR A PARTICULAR PURPOSE.
 */

#include "tac_plus.h"
#include "expire.h"

/* internal state variables */
#define STATE_AUTHEN_START   0	/* no requests issued */
#define STATE_AUTHEN_GETUSER 1	/* username has been requested */
#define STATE_AUTHEN_GETPASS 2	/* password has been requested */

struct private_data {
	char password[MAX_PASSWD_LEN + 1];
	int state;
};

static void enable(char *passwd, struct authen_data *data) {
	int level = data->NAS_id->priv_lvl;
	char *username = data->NAS_id->username;
	char *cfg_passwd;
#ifdef UENABLE
	char *exp_date;
#endif

	/* sanity check */
	if (level < TAC_PLUS_PRIV_LVL_MIN || level > TAC_PLUS_PRIV_LVL_MAX) {
		data->status = TAC_PLUS_AUTHEN_STATUS_ERROR;
		data->server_msg = tac_strdup("Invalid privilege level in packet");
		report(LOG_ERR, "%s level=%d %s", session.peer, level, data->server_msg);
		return;
	}

#ifdef UENABLE
	/* if the user has a user-specific enable password, check it */
	cfg_passwd = cfg_get_enable_secret(username, TAC_PLUS_RECURSE);
	if (cfg_passwd != NULL) {
		if ((verify_pwd(username, passwd, data, cfg_passwd))) {
			exp_date = cfg_get_expires(username, TAC_PLUS_RECURSE);
			set_expiration_status(exp_date, data);
			goto SUCCESS;
		} else
		goto FAIL;
	}
#endif

	/* if a host-specific enable password exists, check it */
	cfg_passwd = cfg_get_host_enable(data->NAS_id->NAS_ip);
	if (cfg_passwd == NULL && !STREQ(data->NAS_id->NAS_name, data->NAS_id->NAS_ip)) {
		cfg_passwd = cfg_get_host_enable(data->NAS_id->NAS_name);
	}

	if (cfg_passwd != NULL) {
		if ((verify_pwd(username, passwd, data, cfg_passwd)))
			goto SUCCESS;
		else
			goto FAIL;
	}

	/* 0 <= level <= 14: look for $enab<n>$ and verify */
	if (level < TAC_PLUS_PRIV_LVL_MAX) {
		char buf[11];

		snprintf(buf, sizeof(buf), "$enab%d$", level);
		if (!verify(buf, passwd, data, TAC_PLUS_NORECURSE))
			data->status = TAC_PLUS_AUTHEN_STATUS_FAIL;
		goto SUCCESS;
	}

	/*
	 * 2). level=15. Try user/group enable password, then host password, then
	 * $enab15$ or $enable$ (for backwards compatibility) and verify.
	 */
	if (verify("$enable$", passwd, data, TAC_PLUS_NORECURSE) || verify("$enab15$", passwd, data, TAC_PLUS_NORECURSE)) {
		goto SUCCESS;
	}

	FAIL:
	/* return fail */
	data->status = TAC_PLUS_AUTHEN_STATUS_FAIL;

	SUCCESS: return;
}

/*
 * Tacacs enable authentication function. Wants an enable
 * password, and tries to verify it.
 *
 * Choose_authen will ensure that we already have a username before this
 * gets called.
 *
 * We will query for a password and keep it in the method_data.
 *
 * Any strings returned via pointers in authen_data must come from the
 * heap. They will get freed by the caller.
 *
 * Return 0 if data->status is valid, otherwise 1
 */
int enable_fn(struct authen_data *data) {
	char *passwd;
	struct private_data *p;
	int pwlen;

	p = (struct private_data *) data->method_data;

	/* An abort has been received. Clean up and return */
	if (data->flags & TAC_PLUS_CONTINUE_FLAG_ABORT) {
		if (data->method_data)
			free(data->method_data);
		data->method_data = NULL;
		return (1);
	}

	/* Initialise method_data if first time through */
	if (!p) {
		p = (struct private_data *) tac_malloc(sizeof(struct private_data));
		memset(p, 0, sizeof(struct private_data));
		data->method_data = p;
		p->state = STATE_AUTHEN_START;
	}

	/* As we are enabling, we do not need a username, but do we have a
	 * password?  XXX unless we have to lookup a user-specific enable pass.
	 * does lack of a username have to be handled (like in choose_authen())?
	 */
	passwd = p->password;
	if (!passwd[0]) {
		/*
		 * No password. Either we need to ask for one and expect to get
		 * called again, or we asked but nothing came back, which is fatal
		 */
		switch (p->state) {
			case STATE_AUTHEN_GETPASS:
				/* We already asked for a password. This should be the reply */
				if (data->client_msg) {
					pwlen = MIN((int) strlen(data->client_msg), MAX_PASSWD_LEN);
				} else {
					pwlen = 0;
				}
				strncpy(passwd, data->client_msg, pwlen);
				passwd[pwlen] = '\0';

				/* We have a password, now try validating.  Assume the worst */
				data->status = TAC_PLUS_AUTHEN_STATUS_FAIL;
				break;

			default:
#ifdef UENABLE
				/* does the user or NAS have 'nopasswd' for the enable password? */
				if (cfg_get_user_noenablepwd(data->NAS_id->username,
								TAC_PLUS_RECURSE)) {
					data->status = TAC_PLUS_AUTHEN_STATUS_PASS;
					break;
				}
				if (cfg_get_host_noenablepwd(data->NAS_id->NAS_name)) {
					data->status = TAC_PLUS_AUTHEN_STATUS_PASS;
					break;
				}
#endif
				/* Request a password */
				data->flags = TAC_PLUS_AUTHEN_FLAG_NOECHO;
				data->server_msg = tac_strdup("Password: ");
				data->status = TAC_PLUS_AUTHEN_STATUS_GETPASS;
				p->state = STATE_AUTHEN_GETPASS;
				return (0);
		}
	} else {
		/* We have a password, now try validating.  Assume the worst */
		data->status = TAC_PLUS_AUTHEN_STATUS_FAIL;
	}

#ifdef UENABLE
	/* check enableacl */
	if (verify_host(data->NAS_id->username, data, S_enableacl,
					TAC_PLUS_RECURSE) != S_permit) {
		data->status = TAC_PLUS_AUTHEN_STATUS_FAIL;
	} else {
#endif
	switch (data->service) {
		case TAC_PLUS_AUTHEN_SVC_ENABLE:
			if (data->status != TAC_PLUS_AUTHEN_STATUS_PASS)
				enable(passwd, data);
			if (debug) {
				char *name = data->NAS_id->username;

				report(LOG_INFO, "enable query for '%s' %s from %s %s", name && name[0] ? name : "unknown",
						data->NAS_id->NAS_port && data->NAS_id->NAS_port[0] ? data->NAS_id->NAS_port : "unknown", session.peer,
						(data->status == TAC_PLUS_AUTHEN_STATUS_PASS) ? "accepted" : "rejected");
			}
			break;
		default:
			data->status = TAC_PLUS_AUTHEN_STATUS_ERROR;
			report(LOG_ERR, "%s: Bogus service value %d from packet", session.peer, data->service);
			break;
	}
#ifdef UENABLE
}
#endif

	if (data->method_data)
		free(data->method_data);
	data->method_data = NULL;

	switch (data->status) {
		case TAC_PLUS_AUTHEN_STATUS_ERROR:
		case TAC_PLUS_AUTHEN_STATUS_FAIL:
		case TAC_PLUS_AUTHEN_STATUS_PASS:
			return (0);
		default:
			report(LOG_ERR, "%s: authenticate_fn can't set status %d", session.peer, data->status);
			data->status = TAC_PLUS_AUTHEN_STATUS_ERROR;
			return (1);
	}
}
